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SUMMARY Silva et al. proposed a universal secure network coding 
scheme based on MRD codes, which can be applied to any underlying net- 
work code. This paper considers a stronger eavesdropping model where the 
eavesdroppers possess the ability to re-select the tapping links during the 
transmission. We give a proof for the impossibility of attaining universal 
security against such adversaries using Silva et al.'s code for all choices of 
code parameters, even with a restricted number of tapped links. We also 
consider the cases with restricted tapping duration and derive some condi- 
tions for this code to be secure. 

key words: network coding, secure network coding, linear network coding, 
universal security, MRD code 

1. Introduction 

The notion of network coding, proposed by Ahlswede et 
al. [1], has been attracting much attention. On a conven- 
tional routing network, each node is only allowed to relay 
the received packets to the next node, while on a network 
with network coding support, each node is allowed to per- 
form some data processing using the received packets and 
send the result to the next node. It is known that the use 
of network coding offers many advantages over the use of 
conventional network, such as achievement of higher rate 
in multicast communications or better energy efficiency in 
wireless communications [2]. 

Secrecy of communication, or more specifically, 
information-theoretically secure communication in the pres- 
ence of an adversary capable of tapping a fixed number of 
links of its choice, is considered as one of such advantages 
of network coding. Such a scheme, referred to as secure net- 
work coding, consists of the following two components: the 
network code which determines how packets are coded at in- 
termediate nodes, and the outer code which is a pre-coding 
done at the source before transmission. Several secure net- 
work codes have been proposed, such as the one by Cai et 
al. [3]. However, these codes require the reconstruction of 
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the network code, or the reconstruction of the outer code in 
order to attain security for a given set of tapped links. Such a 
property causes problems, such as difficulty when securing 
random network codes [4], where network codes are con- 
structed randomly. 

Silva et al. proposed a universal secure network cod- 
ing method [5] based on MRD codes [6] and coset coding 
scheme [7]. This code can be applied on top of any already- 
constructed network code to attain security. However, due to 
its use of vector outer code which requires that each symbol 
be transmitted over multiple time slots, it must assume that 
the tapped links are fixed during the transmission period. 

We consider a stronger eavesdropping model where the 
eavesdroppers possess the ability to re-select the tapping 
links during the transmission. Such a model is worth consid- 
eration because the conventional non-universal secure net- 
work codes (e.g. [3], [8]) are guaranteed to be secure against 
it. Moreover, this model corresponds to some practical situ- 
ations where random network coding is used and the coding 
vectors are time- varying, such as the robust random network 
coding scheme proposed by Chou et al. [9]. Also, the cur- 
rent standard of the IP protocol allows the network to split 
a packet into multiple fragments and carry them through 
multiple distinct routes, as explained in [10, Section 11.5]. 
Thus, the stronger eavesdropping model considered here has 
practical importance when Silva et al.'s method is used over 
the current Internet. 

This paper aims to clarify the security of Silva et al.'s 
universal code against this eavesdropping model, and is or- 
ganized as follows. In Section 2 we define some notations 
and briefly review some of the existing results of secure net- 
work coding, and describe Silva et al.'s universal secure net- 
work code. In Section 3 we introduce our stronger eaves- 
dropping model. In Section 4 we prove the vulnerability of 
this universal code against our model for all code parame- 
ters. We also prove that the code is vulnerable even with a 
limited number of tapped links. Moreover, the cases with 
shorter tapping duration are considered, and sufficient con- 
ditions and necessary conditions for the code to be secure 
are given. In Section 5 we state our conclusion and the fu- 
ture tasks. 

2. Preliminaries 

In this section we define our basic notations and review 
some of the existing results of secure network coding. 
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2 . 1 Extension Field 

The extension field F 9 ™ of ¥ CJ can be regarded as a vector 
space over F„. Thus, when the basis of this space is fixed, 
an element of F 9 m can be represented as an ra-dimensional 
vector over F 9 . For y e F 9 », denote the i-th element of its 
vector representation as Accordingly, the vector repre- 
sentation of x e F 9 .» is written as jc (2) , • • • , jc ( " !) ) 6 F™. 

2.2 Network Coding 

Data communication over a network is considered. We use 
a network model defined by an acyclic and directed graph 
G = (V, E), where V and E denote the set of nodes and 
the set of links, respectively. In this model we assume that, 
each link can carry an element of ¥ q per unit time, and data 
flowing on the network is not affected by delays, erasures or 
errors. 

Let s e V and 'R c V denote the source node and the 
set of sink nodes, respectively. The source node wishes to 
multicast the sequence X = (X\,X2, ■ ■ ■ ,X„) T e ¥ n q to all 
sink nodes at rate n. The rate is defined as the number 
of elements of ¥ q transmitted at the source node per unit 
time. Assume n < min{maxflow(5, r) \ r e fl] holds, where 
maxflow(/, j) denotes the maximum flow from node i and 
/ We assume that linear network coding [11] is employed 
on the network, i.e. the type of data processing performed 
on the packets at each node is limited to linear combination. 
This implies that the data flowing on any link on the net- 
work can be represented as an F 9 -linear combination of the 
sequence X\,X2, ■ ■ ■ ,X„. Thus, the information flowing on 
a link e can be denoted as Y e = b e ■ X using a global coding 
vector (GCV), b e = (b u b 2 ,--- ,b„) T e F" q , where "•" de- 
notes the inner product operator for vectors. When one has 
access to, say, the / links e\,ei, • • • , <?/, then the information 
obtained from these links is denoted as MX e ¥ l q , where 

M = {b ei ,L,--- ,b e ,) T . 

Constructing a network code is equivalent to fixing the 
GCV of each link by setting the coefficients of the linear 
combination performed at each node. A network code is 
called feasible if every sink is able to decode X. When q is 
sufficiently large, a feasible network code for rate n multi- 
cast can always be constructed [2]. 

2.3 Secure Network Coding 

The wiretap network model used in the works [3] and [5] 
on which secure network coding is employed is described 
below. For simplification, only one receiver is assumed. Let 
F be some extension field of F 9 . 

• Sender: The sender wishes to send the secret informa- 
tion sequence represented by a random variable S = 
(S i, 5 2, • • • ,Sk) T distributed uniformly over F k . S is 
first coded into the sequence X = (Xi,X^, ■ ■ ■ ,X n ) T e 



F" using an outer code and then X is sent over the net- 
work with a feasible network code. 

• Receiver: The receiver receives the information se- 
quence Y = AX = (Fi, F2, ■ • ■ ,Y„) T e F", where A 
is the matrix constructed by appending the GCVs of 
the input links to the receiver node. 

• Eavesdropper: The eavesdropper is able to wiretap 
any /j. links on the network. Let the set of tapped 
links be I — [e\,e%,--- ,e^} C E. Then the wire- 
tapped information sequence is represented as W = 
BX = (W u W 2 , • • • , Wf,) 7 e Ff using the matrix B = 

The security which guarantees that no information 
about S leaks out to the wiretapper even when fi arbitrary 
links are wiretapped, is defined as follows. 

Definition 1 (strong security [3]). 

H(S\Y) = 0, (1) 
7(5; W = BX) = 0, VJ c E, \I\ = fx. 

Condition (1) is satisfied if the outer code used is uniquely 
decodable and the network code used is feasible. Cai et al. 
showed a construction method [3] for secure network codes 
that satisfies the conditions in Definition 1 for fi = n - k, 
using F = F q . 

2.4 Universal Secure Network Code 

The definition of strong security depends on the GCVs of 
the set of tapped links I, implying that it is dependent on 
the underlying network code. Silva et al. proposed a coding 
scheme that attains strong security that is independent of the 
network code, as defined below. 

Definition 2 (universal strong security [5]). 

H(S\Y) = 0, (2) 
I(S ; W = BX) = 0, VB € F^ x " . (3) 

The universal code is based on MRD codes [6] and coset 
coding scheme[7]. MRD codes are a class of linear code 
over Fgm which is optimal in the rank-distance sense. Coset 
coding scheme is a type of randomized coding described as 
follows. Let H be the parity check matrix of a [n,n - k] 
linear code C over F. To code S = (S\, ■ ■ ■ ,5^) e F k into 
X = (X\, ■ ■ ■ ,X„) E F", regard S as a syndrome of C, and 
choose X uniformly random from the corresponding coset. 
Using these tools, the communication procedure of the uni- 
versal network code is briefly described as follows: 

The procedures of secret communication using the uni- 
versal secure network code is briefly described as follows: 

1. Choose an integer m > n. 

2. Construct an [«, fi = n -k] MRD code over F ? ™ . 

3. Encode S £ F*,„ — » X e ¥ n qm by coset coding scheme 
based on the MRD code. 

4. Split X and send them over m time slots using a feasible 
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network code, i.e. transmit (Xf,xf, • ■ • , X%') T e W q at 
time 1 < t < m. 



A'hT 



3. Stronger Eavesdropping Model 

In this section, we propose a stronger eavesdropping model 
than the one presented in Section 2.3. 

3.1 Model Definition 

In the conventional non-universal secure network coding 
scheme, F = ¥ q is used, but note that in the universal 
scheme, due to the use of MRD code over F 9 ™, F = F ? ™ 
is used. Since the network can only transmit up to n ele- 
ments of F q per unit time, the universal code requires that 
a secret message S be transmitted over multiple time slots, 
while the conventional codes require only one. The defini- 
tion of the wiretap network model implies that the universal 
code assumes the selection of tapped links to be fixed dur- 
ing the transmission. Hence, we replace the eavesdropper 
model presented in Section 2.3 with the following stronger 
model. 

Stronger Eavesdropper: At each time slot of the trans- 
mission over m time slots, the wiretapper can re-select 
the set of fi tapping links. Let e ut e E denote the 
i-th link tapped at time t. The wiretapped links are 

• ,e„ ,„. For x 



Table 1 The elements of F 



2 2 



then, e\ t \,ei t \, ■ • • , e^u , ei >m , e 2 

(x u x 2 , ■■■ , x„) T € F" , define x e F™ 



as 



v(l) 



Jm) (m) 



Note that there is a one-to-one correspondence between x 
and i. For simplification, let , = b e . r The GCVs of the 
ju links tapped at time t are b\ f , ■ ■ ■ , £y, € ¥' l q . Also, define 
B e F^ xmn and B, e Ff " as follows: 



B = 



5, 









B 2 














- K/ - 



Then, the information obtained by the wiretapper is repre- 
sented by the random variable W distributed over F|T, de- 
fined by 

W = BX. 

We now define the following security conditions that assure 
security against our eavesdropping model. 

Definition 3 (universal m-strong security). 
H(S\Y) = 0, 

I(S;W = BX) = 0,VB 1 eF^ x ",f = 1, •• ,m. 



Power 


Polynomial 


Vector 


Zero 





(0,0) 


a u 


1 


(0,1) 


a 1 


a 1 


(1,0) 


'i 
or 


a 1 + 1 


(1,1) 



with bijj = bij 2 ,Vt\,ti,i. Also note that the security of 
the non-universal conventional secure network codes such 
as the one by Cai [3], is not affected by such a strengthening 
of the eavesdropper because a secret message is transmitted 
over only one time slot. To be fair with the universal code, 
we also mention that even when m secret messages are re- 
garded as one message and are sent over m time period, the 
conventional non-universal codes remain secure. To avoid 
confusion, we mention that universal m-strong security and 
A;-strong security [12] are distinct notions. 

3.2 Code Example 

We present an example of Silva et al.'s universal secure net- 
work code and show that it is insecure against our eaves- 
dropping model. The example code is constructed using the 
following parameters. 

• q = 2, k = I, n = 2, m — 2,/u — n — k — I. 

• F 2 2 constructed with the root a of primitive polynomial 
f(x) = x 2 + x + 1 . (Table 1 shows the elements of this 
field in power, polynomial, and vector representation) 

• A parity check matrix H — [1, a] of a [2, 1]MRD code 
over F 2 : . 

Note that between X = (X\, X 2 ) T and S , we have the relation 



S = HX = Xi + aX 2 . 



(4) 



This code uses a network code over ¥ 2 at rate 2, so it is 
sufficient to consider only the links e\,e 2 ,ei with GCVs 
B ej = (0, l) r , b ei = (l,0) r , b e3 = (l,l) r . This implies 
that the information flowing on an arbitrary link is one of 
X ■ B ej = X u X ■ B ei = X 2 , or X ■ B e3 = X 1 + X 2 . Table 2 
shows the value, represented in power and vector form, on 
each link with all distinct GCVs for each X sent. The value 
of S is also shown. 

An eavesdropper capable of re-selecting the tapping 
links at each time is able to wiretap an element of 
{(P°\Q (2) ) | P,Q e {X u X 2 ,(Xi +X 2 )}}. Recall that 
represents the i-th element of the vector representation of 
P e F q ,„. When the sequence (X[ 1) ,(X l + X 2 ) i2) ) = (0, 1) 
(underlined on the table) is wiretapped, the candidates for S 
are narrowed down to a , a 1 , implying 



HiSlX^^Xi +X 2 y z, )*H(S) 



(2K 



I(S ;W= BX) it 0, for some B, rankB 



2. 



Note that, the conventional eavesdropping model defined in 
Section 2.3 corresponds to the special case of our model 



Therefore, we can conclude that this code does not attain 
universal m-strong security. 
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Table 2 The value flowing on each link and 5 , for each X 





X 2 


Y, j- y. 


C 

o 





= (0,0) 





= (0,0) 


= (0, 0) 








= (0,0) 


ff° 


= (0, 1) 


a = (0, 1) 


1 

a 1 





= (0,0) 


a [ 


= (1,0) 


a 1 = (1,0) 


2 

a 1 





= (0,0) 


a 2 


= (1,D 


a 2 = (1, 1) 


n 
a" 


ff u 


= (0,1) 





= (0,0) 


a" = (0, j_) 


a" 


a 


= (0, 1) 


a 


= (0, 1) 


= (0, 0) 


a 2 


a o 


= (0, 1) 


a 1 


= (1,0) 


cr = (1,1) 


l 

a 


a 


= (0,1) 


a 2 


= (1,D 


a [ = (1,0) 





a 1 


= (1,0) 





= (0,0) 


a 1 = (1,0) 


a 1 


a 1 


= (1,0) 


a 


= (0, 1) 


a 2 = (1,1) 





a' 


= (1,0) 


a 1 


= (1,0) 


= (0, 0) 


a 


a' 


= (1,0) 


a 2 


= (1,D 


a = (0,1) 


9 

a~ 


a 2 


= (1,1) 





= (0,0) 


a 2 = (1,1) 


a- 


a 


= (1,1) 


oP 


= (0, 1) 


a [ = (1,0) 


a° 


a 2 


= (1,1) 


a 1 


= (1,0) 


a = (0, 1) 





7 

a~ 


= (1,1) 


a 2 


= (1,D 


= (0, 0) 


a 1 



4. Security Analysis 

In this section, we analyze the security of the universal 
secure network code against our stronger eavesdropping 
model. The example presented in the previous section shows 
that the universal code is not universal m-strongly secure 
in general. Construction of the universal code involves the 
choice of parameters n, k, q, m, a parity check matrix H, and 
a basis of ¥^ . A natural question to ask at this point is, if 
it is possible to secure this code by restricting these param- 
eters. We show that universal m-strong security cannot be 
attained no matter how they are chosen. We also analyze the 
cases with a restricted number of tapping links and tapping 
duration. 

4. 1 Proof of Vulnerability for n = n — k 

As a preparation, we first derive the necessary and sufficient 
condition for the universal code to be universal f7z-strongly 
secure. Let 



Ac 



s — Hx, w — Bx}\. 



Lemma 1. The necessary and sufficient condition for the 
universal coding scheme with parameters n, k, q, m, H and a 
fixed basis ofF q ™ to attain universal m-strong security for 
// > 1 is, for Vu; e F^.VB, e F^ x ", rankB, = fi,l <t <m 
the following holds: 



Proof. By the definition of universal ;7z-strong security, for 
Vu; e F7, 



I(S; W) = 
<=> Pr(S = s\W = w) = Pv(S = s), Vi e : 



[x G ¥ n qm \s = Hx,w = Bx}\ 



\x e 



o N B 



\{x 6 F» 



w = Bx}\ 
w = Bx\ 



1 

-,mk ' 



(5) 



Equation (5) holds because X is distributed uniformly over 
F^,„ and S is distributed uniformly over F*,„. Note that to 
attain universal m-strong security, it is sufficient to satisfy 
the security condition for all full -rank B t , 1 < t < m. □ 

We prove the vulnerability for the special case fi = n - k, 
which corresponds to the case considered in the work by 
Silva et al. 

Lemma 2. The necessary and sufficient condition for the 
universal coding scheme with parameters n, k, q, m, H and a 
fixed basis of¥ q m to attain universal m-strong security for 
p=n-k is, for Vw E F^, SB, e rankB, = pi, 1 < t < 
m, X w — [x G F^ m [ w — Bx], the following holds: 

x + x' => Hx + Hx' , Vx, x' G K w . 

Proof. By Lemma 1, Vu; G ¥" q v , 

w = Bx}\ 



N B 



\x 6 



o Kjcg^ I s = Hx}\ = 1,V* 

<=> x + x' => Hx + Hx' , Vx, x 6 Xu_ 



(6) 



Equation (6) holds since 



{x G ¥ n q „, I w = Bx} 



= q 



dim ker B 



(bot- ranks) 



mk 



= q ^"-"'("-k)) = q 



Note that if Lemma 2 holds for set X m then the lemma holds 
for any of its subsets. Let i% G ¥ q be the information tapped 
at time t on the ;-th link. Then, by representing w as 

w = (w u ,w 2 ,i,- ■ ■ ,W^\, ,w Um ,w 2 ,„„---w^ m ) T , 

Lemma 2 yields the following corollary. 

Corollary 1. The necessary and sufficient condition for the 
universal coding scheme with parameters n, k, q, m, H and a 
fixed basis of F ? ™ to satisfy universal m-strong security for 
p — n — kis that 

x + x => Hx + Hx, Vx, x 6 X 

holds for an arbitrary set X C ¥ n qm such that Vx G X satisfies 

{b h i ■ X) (1) = 101,1, ■ ■ ■ , (b\, m ■ x) (m) = w Um , 
(Hi ■ X) {1) = W 2 ,l, ■ ■ ■ , (Hm ■ X) (m) = W 2 ,m, 

0>n,i ■ x) (1) = Wf,,L ■ ■ ■ , (bfi,™ ■ x) im) = w^ m , 
for Mw 6 F^. 

Proof. By denoting the /-th element of b,j as b\ \ G ¥ q , 
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= {b m x f + b w x u + ... + b w x f) (7 ) 

holds. Note that since ¥ qm is a linear space on F„, 

bf t xi = bfi(x ( l i \xf\---,x ( r ) ) T 

holds for every 1 < I < n, and adding the ?-th element of 
each of b\, X\, ■ ■ ■ , vf*x n yields Eq. (7). Therefore, we have 
the relation, 

<% = Kt ■ 4°' • • ■ . X nf = till ■ xf\ (8) 

The corollary holds immediately from Eq. (8) and Lemma 
2. □ 



Using this corollary, we prove the following theorem. 

Theorem 1. For any choice of parameters n, k, q, m, H 
and the basis for F 9 '», the universal secure network coding 
scheme cannot satisfy the universal m-strong security con- 
dition for p. — n — k. 

Proof. Assume the existence of the universal code which 
satisfies the universal m-strong security condition. Let X 
denote the set of all x e FL satisfying the relation, 



C (!) 


— r (2) _ 


m 

• = X 


= 0, 


v (i) 

X 2 


_ „(2) _ 


_ Jm) 
' - X 2 


= 0, 


x (1) 

ft 


_ „(2) _ 
fi 


_ Sm) 

~ A fl 


= 0. 



(9) 



Note that, \X\ = q mn /q m f = q mk . Let a be an element of F ?) 
and choose x e F"„, that satisfies the following: 



Mm) 

= 4 m) = o, 



f fid) 
Aj 

A (1) 
A 2 


= Af > = 

= 4 2 > = 




_ f (2) _ 

— A^ — 



!>(»«- 1) 



0,A 



1,X 



(m) 
^+1 



Such a always exists, and satisfies x i X. For e ¥ q , let 
/V^ c A' be the set of all x e X satisfying x ™ \ — ty. In other 
words, Va e X^ satisfies Eq. (10). 



r r (i) 

Aj 

r (D 

x 2 



JX) 



r (2) _ 

Aj - 

r (2) _ 
x 2 ~ 



= A*; 1 ' = o, 
= a<, m) = o, 



Jm) 



0,A 



if,. 



Note that, 



holds. We see that, 



(10) 



(11) 



' x W 

1 


= xf = - 


_ „(»■) _ 

- Aj - 


0. 


A 0) 
x 2 


= xf = - 


_ J"") _ 

~ x 2 ~ 


0. 


r m 


_ y (2) _ 


(m-1) 






— A fi ~ 


• = 4 


= 



o,(r^ + ^ +1 )""' = 

(12) 

holds for Va e {a} U X$ by the definition of a and X^,, where 
y — iff - a. Note that, Corollary 1 can be applied to the set 
{x} U Xy because relation (12) can be represented as 



((1,0, .Ill - vi ! ' 0, • • • .ul. ().••• 

((0,1,0, ,0)-*) (1) = 0,-- ,((0,1,0, 



,0)-.v) (ra) = 0, 
, 0) ■ xf m) = 0, 



((0,",0,^_l_^,0,",0)-.v) (1) =0,- • ,((0,-,0, y ,l,0,--,0)-;E) (m) = f, 

and because it can be confirmed that the corresponding ma- 
trices B, in Corollary 1 satisfy rankB, = p, 1 < t < m. 
Applying Corollary 1 to the set {x} U X^ we have 

a + x' => Hx + Hx, Va, a' € {a} U X f , Vi/r e ¥ q . 

This result, combined with Eq. (11), yields 

Hx + Hx,VxeX. (13) 

Corollary 1 can be applied to the set X as well by relation 
(9), hence 

a + x' => Hx + Hx, Va, a' e X (14) 

holds. Therefore, Eqs. (13) and (14) yield 

a + x => Hx + Hx',~ix,x € {a} U X. (15) 

However, by a t X and \X\ = q"' k , for Eq. (15) to hold, it is 
necessary that 

\{Hx\xeF^}\>\{x}uX\ = q" lk + 1 

holds, which contradicts with 

|{//A|AeF;„,}| = (O rankH =<? m *, 

Therefore, a code constructed by the universal coding 
scheme that attains universal m-strong security does not ex- 
ist. □ 



4.2 Proof of Vulnerability for 1 < p < n - k 

We now consider the more general case, 1 < p < n — k, and 
prove that the code still cannot be secure for any p. First, we 
define the following to simplify the notations: 

• H s = {a e ¥ n q „, | s = Hx}, 

• X* = {x e FJ, | w = fix). 
Now we prove the following lemma. 

Lemma 3. If the universal coding scheme is universal m- 
strongly secure for p = 1, then it is universal m-strongly 
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secure for ji — n — k. 

Proof. When universal m-strong security for p. = 1 is at- 
tained for some code, by Lemma 1, for Vw e F™, VB, € F^ x ", 
rankfi, = 1,1 < t < m, the following must hold for this 
code: 



N' 



N^ w ,Vs,s'e¥ k r 



We will show that, then, such a code attains universal m- 
strongly security for p - n-k, which implies that by Lemma 

f"- k \\fB* t 6 F^ )x ", rankB; = n - k, 1 < / < 

B* 



1, for Vw* € 
m, 



B* = 



the following holds: 



B 2 



N 



S.il 



Let B'* tj e F^ x " denote the i-th row of B* t , and let B' denote 
the matrix defined as below, using the matrices e p»xmn^ 

Note that B' is obtained by permuting the rows of B* . Let 
w' be the column vector obtained by permuting the rows of 
w* in the same order as B', and let e F™, 1 < i < n - k, 
denote each m rows of w' as shown below: 



< n - 


-k: 




r 










B' = 




,B [i] = 




B [n-k) 





,r-\ 



„[n-k] 



(16) 



Using the notations above, we have 



* s,uf 



[X € . 

[x 6 : 



s — Hx, w — B x\ 
s = Hx,w = B'x}\ 











r 














B m 








x e Fqm | s — Hx, 








X 








w ln-k] 











n-k 



s = Hx 



(n-k 



Noting that 



we prove N?\„. = ATf* ,„., Vsr, s? e FfU for each of the fol- 
lowing three cases of the set (f]^ <Y^]) f| 

7 (n^^-OnH = *,V* By U,W, = Ff r , we 



have 



rk r> 



i=l 



which contradicts with Eq. (17). Thus, this case does not 
exist. 

Case 2 (n£? fl H * <f>, Vj: Clearly, 



holds. By Eq. (17), we have 

'n*s)nu*. 



(18) 



se¥ k „ 



u n*s 



n?{, 



LVs. 



The last line yields from Eq. (18), |F*„| = q mk , and 
Thus, the lemma holds for this case. 

Case 3 Otherwise: There exist s\ , 52 £ F*„, and 1 < I < n-k 
that satisfy the following: 



N 



*0 



However, A^ B '" m + N d "' ,„ contradicts with the assumption 
that universal m-strong security for p. = 1 is satisfied. Thus, 
Case 3 does not exist. 

We considered all three cases, which cover all possible cases 
and are disjoint, and conclude that the lemma holds since it 
holds for Case 2 which is the only existing case. □ 

Assume the existence of a secure network code that 
satisfies the universal m-strong security condition for some 
1 < (X < n - k. Then this code must satisfy the security 
condition for p = 1 because in this case, the amount of in- 
formation that can be wiretapped is obviously no more than 
the case for 1 < p. < n — k. Then by Lemma 3, this code sat- 
isfies the security condition for p - n-k, which contradicts 
with Theorem 1 stating that universal m-strong security for 
p — n-k cannot be attained. Hence, we have the following 
result. 



(17) 



Theorem 2. For any choice of parameters n, k, q, m, H 
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and the basis for ¥ qm , the universal secure network cod- 
ing scheme cannot attain universal m-strong security for 
1 <n<n-k. 



4.3 Restricted Tapping Time 

Now we consider the case when the tapping duration is gen- 
eralized to 1 < m' < m in addition to the generalized pt 
considered in the previous part. Since the tapping duration 
is restricted, we do not restrict fi to 1 < fi < n — k, and as- 
sume 1 < fi instead. This imposes an additional condition, 
B, = O, Vf e M for any choice of M c {1,2, ■ • • ,m], \M\ = 
m - m', on Definition 3. Note that the set M represents the 
set of time slot indices at which wiretapping does not occur. 
We are interested in, with which pairs of fi and m' the uni- 
versal code becomes secure. From the discussions up to this 
point and the result of Silva et al., the following is clear: 

• jj = 1 and 1 < m! < n — k: secure 

• 1 < n < n and m' = m: insecure 

• 1 < fi < n — k and m! = 1 : secure 

Additionally, by the necessary and sufficient condition of 
universal m-strong security in Lemma 2 we have, 



N B 

s,w 



«* JVf„ 



w = Bx}\ 



(19) 



Since the RHS takes a positive value, and by the definition 
of Nf w the LHS must be a non-negative integer, a necessary 
condition for satisfying Eq. (19), or the necessary condition 
for the code to be universal ;7z-strongly secure, is as follows: 



mn—mp, 



ink 



> l 



<=> q 
<=> m < 



mn—m'n ^ 



ink 



m(n - k) 



(20) 



For any fixed m', m, n, and k, Eq. (20) is unsatisfied for 
/i > m(n - k) + 1 because of the restriction m! > 1 . Note that 
being able to wiretap n arbitrary links allows the wiretapper 
to obtain the maximum amount of information that can pos- 
sibly be wiretapped over the m' time slots, by continuously 
tapping the n links with GCVs that form a basis of F". Thus, 
the amount of information obtained by the wiretapper with 
fx > n is at least as much as what is obtained by the wire- 
tapper with ji > m{n - k) + 1 , which implies that the code 
is insecure with fi > n. Thus, we have another necessary 
condition, 



H < n — 1. 



(21) 



Combining Eqs. (20) and (21) yields the necessary condi- 
tion, 



fi < min 



\-{n 



k\n - 1 



5. Conclusion 

We proposed an eavesdropping model where the adversary 
is able to re-select the tapping wires at each time slot during 
the communication. We proved the impossibility of securing 
against this model using the universal secure network code 
proposed by Silva et al. for all choices of code parameters, 
even with a restricted number of tapped links. Moreover, 
we considered the case with shorter tapping duration, and 
derived a necessary condition for this code to be secure. The 
future tasks include improving this condition to a necessary 
and sufficient one. 
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